bump min pass length from 6 to 8 chars